cd20fcac844c908678d64e864742d9ea02b8345c2d772c5ef8af4fe37151e73a

Analysis

max time kernel
149s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe
Size

153KB
MD5

60e1f328b05f12270f5fbd3f94516270
SHA1

5aea5ad48719bc31990b1c15534a0edd271a8414
SHA256

cd20fcac844c908678d64e864742d9ea02b8345c2d772c5ef8af4fe37151e73a
SHA512

5e15dfe87b7527498fbb9479fc195322fb54104a0622e8e58c29dc36f5dfe9a02b70ff0acd413a1f55eee96ec91d5fd70485e80baa65974970967e4b112193be
SSDEEP

384:GBt7Br5xjL9AgA71FbhvoBlvBt7Br5xjL9AgA71FbhvoBlr:W7BlpppARFbh67BlpppARFbh8

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5054) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 2 IoCs

Processes:

Zombie.exe_MS.POWERPNT.12.1033.hxn.exe

pid process

4680 Zombie.exe
4932 _MS.POWERPNT.12.1033.hxn.exe

pid	process
4680	Zombie.exe
4932	_MS.POWERPNT.12.1033.hxn.exe

Drops file in System32 directory 2 IoCs

Processes:

60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

Processes:

_MS.POWERPNT.12.1033.hxn.exeZombie.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\ConnectReceive.iso.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	_MS.POWERPNT.12.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp	_MS.POWERPNT.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	_MS.POWERPNT.12.1033.hxn.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe

description	pid	process	target process
PID 2460 wrote to memory of 4680	2460	60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe	Zombie.exe
PID 2460 wrote to memory of 4680	2460	60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe	Zombie.exe
PID 2460 wrote to memory of 4680	2460	60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe	Zombie.exe
PID 2460 wrote to memory of 4932	2460	60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe	_MS.POWERPNT.12.1033.hxn.exe
PID 2460 wrote to memory of 4932	2460	60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe	_MS.POWERPNT.12.1033.hxn.exe
PID 2460 wrote to memory of 4932	2460	60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe	_MS.POWERPNT.12.1033.hxn.exe

C:\Users\Admin\AppData\Local\Temp\60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\60e1f328b05f12270f5fbd3f94516270_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4680

C:\Users\Admin\AppData\Local\Temp\_MS.POWERPNT.12.1033.hxn.exe
"_MS.POWERPNT.12.1033.hxn.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp
Filesize
77KB

MD5
73884c9805d6c129e2f1353d7a238a83

SHA1
059ed85cc9a21fba9c2b608062593f6424ba356b

SHA256
50f52a40bc789c02a79cc0d7daea8ce2e2a237c36e6cb1a70af93d99d3e99023

SHA512
122b884c332ef9d1d5b64f3a5cb786620c6f75570a431b79525f0577537360c3d6e648ee12ce77bff96e1907a7d0cfad8536f9c02010784c76b7d9c5cce65a11

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp
Filesize
189KB

MD5
749523dc7ae3929f49bf9be192aad0af

SHA1
0aa182e321b3c8fc17ed6f616326e952a4a8e00c

SHA256
1f14b3ed11b15deebc7bfb9f6324ffd5bf297ff8b6306d6fb86cbe243d09a788

SHA512
de12d2a734689e8f532bf6e7a34b0bfe3fffb32aae1c1a2c85c284714190b495e22646d940d615ef26ad90c4bd26bc8f9e45a8267f9298bf047d6e9c891b91ce

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp
Filesize
142KB

MD5
af8d587510e022968df3baef4c15ad0d

SHA1
f598ae1dbfb39130e4db3be9779b4ca2021928ff

SHA256
d5e69c3e7ac65b6e9812f5bdb2a76eae20af6f8b7847d2a9574a330604a06757

SHA512
2d297e33952ae3c08ec78ffd131b8d7dc0270cb3dab8dd561361b55d9284f9966e6e39f72b054dcc150aa2bb5abebd4d25d3d59ac98cb67d6ffd361026eb4bd7

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp
Filesize
1.8MB

MD5
88c92f27c3c69e136d07c6d9b2f96236

SHA1
d0be8dd3aaeeb9a2df1f136ab686a48afb6ae3e9

SHA256
83c6afc29d1ca803bf58bfb0f399b412ee0e110254ed50a29db2ca4941d04d29

SHA512
278db418f0f1886af83b3be988605fd0ea22b3453b01fa60b1871b27f0cdd0ac6a5a2b670a0cb05c9b7d03911db749aa3ec84bff9df8e1109d141c6e0a57fff8

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp
Filesize
621KB

MD5
8909dcc40984c42c5e19c85fbbc842cd

SHA1
a57543b372d7d8a2b7fa364be38eb5264b216847

SHA256
f96f75f59ae33dc0ed70ff7fcdbce6ce4b42969dfb080d321630e28b367c0e66

SHA512
43d522d6fa4397c1a9c6a37b5df52e872994abd5309ba49cce25eb454c9753608e2f3ae63a0a04f3f03a1aed71090b9e9cbcf9943609f314092d993ce7c0e32c

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp
Filesize
265KB

MD5
dd1efbd9db0a3a02322587eba8dfe64a

SHA1
5f864d14a01e51005e99ce83fc8691a0de970139

SHA256
73512dc11b039bf6f75e4af0f8e3d797a4f7996cf89b3ada6e2dfbf99471dd08

SHA512
50ce6357ea8f901d449f004c611b2ddc1f249616cf0d69b27d7fee7b242118db1571ab4a3fac9417749febb95905c2fd850d927354e62579a8ed0359d941415a

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp
Filesize
1007KB

MD5
03eeae2611ad19961a360dbb6af395e5

SHA1
9595e33593e9219de96a077a03d3ca99c2cb8466

SHA256
12a89f5876018b6ba5a03c01271517193402609e117369d6b80f8c20423fe5d2

SHA512
4b51addcbf3ceb4b81a12d611e82ec4ad8f73879d76ec14f35f5329e484b5f9e3bdbfce65b2ea0951e661e33879f3aabd68670b03d66500605d20d2094fae180

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp
Filesize
761KB

MD5
303b92e86847646443375779562d8eff

SHA1
6d066f302dbb436deb45ff5a75a076065f6ffe53

SHA256
3044e40013055cba8d66c8397ce1d6b2c910b3fbe9dd20b5abc5177490c4ba23

SHA512
be466626bfe51f2af9724edce189931b4816f87fbee851dd0fba5e558ad1a1e434c3a0b9e833c3f76bc7231b2f4e383e12d7fbb39a327cef164436ceaa0f4206

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp
Filesize
84KB

MD5
8f28a082e582090d5fcf6f9b061e9fbe

SHA1
08b5cf7504a3b8c12503f1eb6a7d42a922b425d1

SHA256
03263501dc2774fd0896a4fa1ace8827f4fd21a7aec41ae5342970ac594a4666

SHA512
8d302795ad70288c1d2f320982107bdc71d9297d77d153a69623374a6f57d7d7d9a3cc73d59b3b067c7cacfac5dd0804e9d401dfd226a6d0fa2f32634049321d

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp
Filesize
89KB

MD5
f1a0580158e3cd7f83b849e61265f4bd

SHA1
6f59784eb6f060e241145f47cf192cf82861b4e0

SHA256
12148bdd1cf7205c5eb812b58afdc6c96e352df018aabbd9aed616477553c72e

SHA512
c7cc993badea164dfb09cb7f11a333239b64831718ddf2ba3c240835bc33d8639ba9d31a3f35fbaadd15544265ddbdcee51e6901fa6921c04fc171416ef7e4f3

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp
Filesize
76KB

MD5
694288b711338c3bea97fb35de2f778b

SHA1
a0583cdc249e93bfe348a858c05904533d324ab0

SHA256
9201feea3e6fc959af91d71bdf89c0adfe033a65621e02d0689649fb9ff5d554

SHA512
b70c917c20defc9f7cda15b6b70cc95db0c4390f2a24d15d029ebe86acbface0d861cf18299199e4f49bd49a0755ff2390af105e69f49c76440d08e13494c3d9

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp
Filesize
88KB

MD5
e73472524d9b692b135b9b393e0251ea

SHA1
21cca57f1cf487e357af2ba75516512aec4fb8cd

SHA256
12699b9c8fae3a9270d72928cff2c4e896ff77ef69297b584dfa82c78e509a1f

SHA512
809cd6a91d42b56b0974fc9739e2bb1e25869ee66baebca954da5b687582c25effa755bddf17ac91282a85bf1587ae61c373dcd9959d6a12652a4a265b50b6db

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp
Filesize
88KB

MD5
53514eb2042df7e58bc96e6d6186cf0c

SHA1
f67896296a66967e32c09ce22c4ebad226d232a1

SHA256
7c9bc8335f1271e181855c6b1e813070b51833f6af806c394f5ae1e179b45f45

SHA512
ef0911004362cd67d3bcc3833f8dc9c76707448dcc8eac39abe0639fb6527c87f2d326ed0e0c59400723dcafef93aacfd43bc84e6e80a58c05aa5e507618a9b3

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp
Filesize
89KB

MD5
8d85c289677723daea63ca2d9e7a89fb

SHA1
87c988665021cab64269a94a5bdeb7cecd69c760

SHA256
4a57b98664183e71251bc974b3bfc08850863f6aea0810e0119bb794fd52228d

SHA512
e79adb74e01d8d3221677916ac28a94d63f8a2303e915eba4565b6bcd663b8658d0976b32299688d4bf3699b88fb5bfa0b612527b189af8401fd54af8c60b601

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp
Filesize
91KB

MD5
f64361dc581e743c6e4351c15ed00bb8

SHA1
b2c88d1df540386e2d51cfbaee40effc587cf13c

SHA256
e0a5a25aa81cc715c6ebe48c00792b1ced03eeb4058a3ebd8416b8d6e1035505

SHA512
ae639fc0b86cd977fa2dfd802c9c31568085eb02b60bb3faa37a63469e212a0e12d1c3f62d22330a3def9838b1556bb82424d9c1901d6e2f64813292ffcae714

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp
Filesize
82KB

MD5
ceb6408fc50f045c385227656ed36979

SHA1
08b0d5d0026fb0b32d3d1f07bc08000292625fe7

SHA256
cf63827d15dd239894f18d61a17e969a9ffd2f0d7423be6ff45f234f2e2513ec

SHA512
66ce557ea739af733446c8621332446be1c2a661f9de66ce26871faa70a0eae6e689b8157e5ce3b58b5ead1b39c3ef861081ca8389407c0612df1e79eacbd331

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp
Filesize
86KB

MD5
919a26a0786e31737e0c38df41276d3c

SHA1
cba0668ba92c340c753b2ca9a3831483c3a3840d

SHA256
52a7ee757fa90d299e0873c5bc36dbe0ca86d41ceaabba43841d70fcca506bb6

SHA512
51c2bc9910335d81cfe679ca618181f26d2237f400449c50e6b352b2254e99f8610a8ee0f9d5ebb0e28edd5f26b0c58a44d9c368600194565b080a81de4208b5

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp
Filesize
81KB

MD5
1c93f8faf79af4a2e505305fc2c8a3d4

SHA1
b0083256346b37d628f4dcbd4fa684a5c6525735

SHA256
fdc34ff7bd330a3d1bfa408220fd4c17b1c4eac5aab82e53018f8ef7fb1e8a86

SHA512
9cabdf5ab6ca5ce8dfe7826578757d923ec30b34238c6cedfe6722f943212debe9196cc5ea14ee16bcaf695c328927ad3997a789faaf3a0f07c9da43c8064a9c

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp
Filesize
86KB

MD5
31e9e1d26e1d8915989c9b6acd03f087

SHA1
c6182d2a0bf7eb4b14e68f431c64bb986a9f3b01

SHA256
dafd568bab18f7987f5d47276211929b2f270b3ea55cecdfe00d7b185da1c687

SHA512
b63e09bdc781434c7c398d7f5acf79790f81e9cc64099f651ab2a21c15218703f7f4ab224efe0b9042c8dbddc30fd17108b6e7cc1ae6a2f1567891b8c45cae7f

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp
Filesize
93KB

MD5
23ba24abd41f0d9faa5a66945ba315b5

SHA1
8a474643717f6bcadc7eead4ebc2b1c5505b8c44

SHA256
da4c55d75d7e0b633a92b23ee44199c820f6dda3fd22aedd541e36db4f7206d3

SHA512
e3043b2e2437e78792bda37c04c5a385cc53719c4f3404e4397f2c152a37bdf041d339dfc7d4d1e7793fac3f0abf896899378ae23a313cb8c32881f126fe498f

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp
Filesize
84KB

MD5
a316197484aad8a8a48df1545ac11d8d

SHA1
b8cfd466248b5e3b7bb790befde4150197cc8eb8

SHA256
b46ccd3887b4f994b2db212b0b27b1a624f237e43f85b3c6c14f74269a688dfa

SHA512
5a806012d33aef65fe6065ee96f43542b8d790df17f920ff94799baaabe1b454fed8cf8802ad5b18a89abbe17cc6afe5e91a2c2c4c7221da77f846d07adad8d3

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp
Filesize
82KB

MD5
79eacc68a6b3fc745bb6e141fa495bee

SHA1
28fca908ffc40a9fa5812d60d8d0d0605979056f

SHA256
3c03e8b2a0369d74e0358fd9fab2bef11bc78df035e36e85e053db938f80df59

SHA512
7676f3623e5c7da3c438839175633f8a5daaccfb9d2605174eaa81d54fa0227d4e7089cbe70c23e51f36c1458a85fe7caad1d8d2c8226200324bad77f4c7e1c1

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp
Filesize
86KB

MD5
88a8d62db88368060b1f0d54247f4812

SHA1
f626a0a2c1ddb371a2c60aad5b362c55efc85ee8

SHA256
a263db07ce93ec646f88c309b41415483179cac0a650fb3ee7abae82e4f9611c

SHA512
e3d23aa844d366ceb116900d5faada6ae11668b3eca9f8b0a1ea8156d78a55bbb0039d3508a5d708b16cdd43df3d32388e0a21f2aa24e0532d21700729e0e6b1

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp
Filesize
83KB

MD5
841d8c46ce0c15a094c7355de3348744

SHA1
15dc51cd8ac4be4cb9300db6b04cf9ac4a4a9ffd

SHA256
de6e7435c41be015f8e2e7d3a3210ebabc4e7c60282b43514cead449e597c750

SHA512
6214788591c0b6623e84ff40d74fd3712477237baa9630d3a295b4b3d3c828ca079b0e57693ea3acc0408fa4f9811b6870c1fe625ff01e47749eafa016c22789

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp
Filesize
90KB

MD5
61cbc2f117781a54db7d8ec5c7feb2ec

SHA1
d088ad289792bd5c24f62ea6f7cacb81ba452150

SHA256
bcab0b82c918d31943c285b549ba9b79f9be4194d4b184c1358384a8cea0e928

SHA512
1d302e9e594b2fe93e8d3bf9affb759e0e98f11f73bfc07de090b9b55d12ad8257691f95a5a11579fdef8a5045d7964a44806c9c671e637d3294a229c65e1b69

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp
Filesize
85KB

MD5
2aa5f6fd78c76d96afe499c07865f09c

SHA1
2ff2bd6fc7a9c935a1aabe7424182724c112af0e

SHA256
74561fec191a991b154b938ffb550b300d7688cc445cabd8ce0986b564891ffd

SHA512
d2531497f91e2ea5926446cdc7993bce81a859f89c6753469225ad6cb7679cf25c099e974b47edd5dad4cfe598149d3c1b9ff08277e5e3ab5fbe35c1d028c7ea

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp
Filesize
86KB

MD5
fa1adca05b7b50f99130113ee73d1c7d

SHA1
8939f422bcec944b43a570515b388f719e6fb01b

SHA256
a101bc55eb0b8cd47e4d1da6fa5e8f0f5627af3d7199d956aac61d11e62c0494

SHA512
ca571992f50b932affdfc6a0d9867a61e074504eb5876317b592d620ecd0f5cc4c07d77baff946ea1d148eb0d95741464094402506c9fd93dff70333f8d1066b

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp
Filesize
84KB

MD5
3f2c87d85dca39091e3ada8e5758d8d4

SHA1
97ab2907a20b091910b3c6f274a82a0677b98365

SHA256
7e8a645dfe219995f65ee3f9f7d09525aa29e3afc65cf0b84138861734f591c8

SHA512
ab5a8ba5ef4096c6260095009f72a1c202a7f83ec3dd66be7dbe64200362f0a095737d11adb49fde43fa657050c0130f8dc38e0ab8e45d19be72e8f4796e1a86

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp
Filesize
83KB

MD5
a5dbb94294f21dfb36587a37236c4dc5

SHA1
fe8242d01610807d9c307313eb863899f0c0070d

SHA256
9a2ebe2daad55661dc31b9e8cfa7dd09413a0568970748c5f2af88c67abb8aef

SHA512
d025053b7690fcdd7019fa7db364c2b0a5fb9ff10a096b38606683266b6eaca8a2b11ed6127f427e6d2bf285554dd94494bbe70d09b0a9b6e13d9c3fa574301b

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp
Filesize
85KB

MD5
f93e2251804a3c4e8600cc8e89a956d8

SHA1
367daaf1fb82f5f8692f40e0943e1993186930ef

SHA256
aa2ec99b01f73d55e7328156d620c156f7e607928ca0ff2a8a9c91bf7499bc3e

SHA512
42f481e4aa30da8bf28959a60698aa7c2456bb73a8f14f83a887ad2c993b293c06ff34e4bb148acf95709c867193ff8c3d86994a4b4d1b99ada8e98cfc1133df

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp
Filesize
94KB

MD5
8eaaddd40ebaf9f32de881cc9760e791

SHA1
d680b8a19a46c35eb8435e72da15e3d93a1d8ee4

SHA256
435281001f34417d4743def55c130f86f7930415e21758d65f3fe856cecb673f

SHA512
1bf06979374956b11efc4675dac0902454a1de385cd5de0808b870d2e989bf91991b6a6cbe4a09e4a0a53a9af9ab7befa070c07421c86a9a003da022a621d8c3

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp
Filesize
94KB

MD5
9ad8ba90b1f29d2103d118a78bc1e256

SHA1
f3e0361c7f465c03de528e53bedc621b5856f87a

SHA256
2797e3502c8929645a31674296228ea303882735cbe5ba8de40c2f788a0dc7ad

SHA512
82cc0f1037107603ef0fd08608d9aba35b48a74f53db0c32d1b48988f9c17051fffc92214fb59027f9f20e9dd73e65bbeb2faa00a9146fb846ee48c9dad26913

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp
Filesize
86KB

MD5
e8fdc2ed890745710005598aa60839d7

SHA1
bdcaa463914aa6c3f56418ebd6e0deb4ef4ddf74

SHA256
7da23e1d432110131dcedac4234a3eb20fa3e92056f2603061ad502e20c13599

SHA512
0b9f31d8b1f92b904f30e817072d39a31a404b8ee5a44d2f8a482db90d30df10ac770224613c6ffb5f3708ec82055173eae791d8ad339995560578a38b67af6b

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp
Filesize
85KB

MD5
e36615e9e96b415d1b48e73cc467a2ad

SHA1
545ac7b1ea708d2375e6b6891e6f596452d4558e

SHA256
1a8b434189e99093131c95557bee54d51811c0bbac7b94a0827be07348322c7c

SHA512
b3d8adb003212d223288e40f177e5bd7bf584eb213f81107609d7508ebb1581ccda053fe4b3d93c798cf31ffe8619dd523bd962bc62da03819e99f47663297b6

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp
Filesize
85KB

MD5
f4f279d5261674d2a7ac55434be66b90

SHA1
6b162ea921d48875418f47715c9037c71c54e62f

SHA256
fe99c7fb57939a3c7deaac95a5184ec8d6680a44c5f8ba41285eaa7fefca6bbf

SHA512
f1e7005c6ac5e79d9d558f48b8e11baf8119031781c0386ece0cad85dd38f8e01e4ff0b73341aeb4728c92b1c82ba3705497aced32bd57e83a1452223250f275

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp
Filesize
88KB

MD5
84028507d1ad98655f4c81c802a69f37

SHA1
4c13745ae269fad9e408f6d5e78cc40b65c45cf3

SHA256
4c4a34125325fd4b38272be0c3863872d8d7a22e9c0ce5069c71aa18bd35dcdc

SHA512
0a5619af54b80cbf465ae259d9fd88cc79bf8b3f535babdea7511565e16095c88a08af5005f5f5b8d0b70e6552c532535fa7dc239d6ce2a2fabedc6cdc9d777b

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp
Filesize
94KB

MD5
4d07832ede717e25fa8838b91b112445

SHA1
d6732a9601d01e2a7ef6ca2cadfc3eda617d77d1

SHA256
5b312976aff999771649a6242da77562368fe12da7550525a96dd576cfcabae6

SHA512
f93435f769c18b5371110a38eeb599f48a966fb2c2325e3ad9815ba0d73eb4e2f23f67b143db412f14d18653dd3a599fd06668497599e02c4d2ec49af7ffdc5e

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp
Filesize
86KB

MD5
b5521734aa61a2d397c7ccd71310e83f

SHA1
0b79bd91b386b3d8fd41a90d9b2bc76e8e5f83c1

SHA256
ef26ff529a2e60a469c0334ce8683f6df08c7aac3429b1f976e899c3dba8dc8e

SHA512
0a630593972a9bc89fb38ddfba33d2e95fcb630e72c6d31027888d34c7c56538aaa42950a12c5aa13d3b7b51807260363ecb17dccdd1bca0b80c8648e1addc4e

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp
Filesize
87KB

MD5
3868a9df7f06e3075e039734163cb58c

SHA1
c83de65144a398a85bb006980475698fa94dc786

SHA256
ba3e7a58099064880698ffcd3eed68cd692a5f4b9401588e570c7c3072cddebe

SHA512
df29410a26b6a2dd3a12e745c5fccfe4121448537dc441e998fca295ad028257ce8751600ceb7df91283f904293f9ad68c1e330f1c08a475e1ddf6bc5c28bdae

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp
Filesize
88KB

MD5
904140563a743e177a00942550c4c77c

SHA1
ec896d69f492702fac0fbd66164fad898e647056

SHA256
cdfa83c3ee7ab9c2198c3ce1f91b7618713f3cd899931955273a4b81ef5082b1

SHA512
fe86b9896dab939da3f9eadf8ce12060c0fa33d6c1f944a84a52a5b6fa7923905b056dc88f68cdb916d398f2fdc46ee9aca36c8615494258e23bf217eb4cdcae

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp
Filesize
81KB

MD5
ec3aff1823625316b500ec90e5ac222d

SHA1
acc85923d7987aa03f9f489b79ce07d74c51ffcd

SHA256
67aaf7dea71981776cdf5ac886049db91563e52b34a91d31253bc6b5a666df7d

SHA512
8f15c704956c105500584781fc2292b3e15de2c399d258d74aefb5bf5371405dfa4c91e15808d605246cbf29d5fde72b223b74b2bd1098a60444906c7aea5949

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp
Filesize
85KB

MD5
4f38411fba61960f704f642949e0737a

SHA1
6690730cbb928d1ed8c24f5be58a66d393a5c435

SHA256
8970cf2b48b22fad4c757e07b26d6001c506efcde27a517cace3010506fe3488

SHA512
039ba9dd772fb605eca1f66ea3684bf3390f68e1835192074f785889e3b7fc333e6c4ba246d1b0a76749405d13e95ddbec816d065cddc9f5142d5576fc8ff7e4

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp
Filesize
96KB

MD5
8782a3e2ff53156c22f949a00d525ab8

SHA1
86d59090d0f8e7097fe5b777a94ea9c7431f050d

SHA256
9ad3b08b7f3d372f0b08cc73f22eded7c50e8decdce011c43c5684acffd49ef9

SHA512
cde6abb9a79fd858e1aecf3d7c395358dba3c58c9b9996c16e28d0588353536949ae9c63cdf768ca9cd21b243064c2caf7f4c7cbe58b712c21fc7358b7bda3a4

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp
Filesize
87KB

MD5
a847fd2a16cbcfccda8b0c78b1e93d02

SHA1
b7785dd818cbd94ed0784e6fddd05b6b17f32e50

SHA256
31e06bded4860900c162ab3796314a5dba645f547aa807a20435507fce5a7a56

SHA512
807568ca8f052ad90094f4206de0ba2380db1ff19ae370ea471d2a6aa72ed4a76165a895ee33337a9adc2402a7d74396578c697c4e7b6d3486dfdfb6d991de6e

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp
Filesize
81KB

MD5
02e5c2c1814fd95a19051bacfb8f4759

SHA1
6f879a1a6634687ed30bf7bdae49e3b5af15719a

SHA256
e9c934e57e423b02c30d1403498fd49eebe027356e69dc7e069a78d4d4154ab9

SHA512
84e454740959de72bfce0bec81f2c2b3ac4de3e84b27c29211e7eca00e316ee780e5d06a203bab816de1a7197d98a1e4dd72248715a2ce809431c48a70220e7b

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp
Filesize
90KB

MD5
09512a82e07b4f94c58a7a40368f2e2a

SHA1
8d163d9473adb5453e5359ec4949f7e5b4278f73

SHA256
ee773dda54528a58024ad2ac76ea04c6ab778b1bee7cf33ff1fcf0fca1368583

SHA512
9ef28789204469217b0021e215fb0af02b0a45a34693e7f3f6db980ab98cc598fa3cceab979eecc9b87fd20edc1ea20b6675d7686ce72d090360eb2058dd529a

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp
Filesize
85KB

MD5
32ee4e44329105b46d07f664229d761d

SHA1
43cf4981e3f547a143d2d8e87f338dc3c066b3cf

SHA256
36e34b7917aff11e85369ed8695bf4a55bcfd1a954fbf9a9d6cadafde9ebe253

SHA512
0cd443c1f8d266f658e8b5702a7c3f51394c2d0917ecc205275848c4e93f28bdd1f2cd84a10a8d1a39d86cab35b7a6d2184d6a0be69d3d8f5ef17d01a09522d3

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp
Filesize
86KB

MD5
e585f145cdd82652ce63158ab2d555ce

SHA1
1e79e40143a41ade3e67f49a339072c007d233f2

SHA256
fa484a910470da5989d10b7fb5609f8460c691995db2aa4f086fbbfccaf06ba4

SHA512
946b21f7070e58c50af4e71519c94ec367ec5cef76df718dcee9a1b65a826d4a0edc5d26a4fb685129e48598d179cb27fadbc88dc727cba380fd514f44f94bd2

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp
Filesize
84KB

MD5
4ab24dc1731d3c6b9b51fde6bac7dcb7

SHA1
faa070369a1770a972a9b44bab41248dbf1f6bb1

SHA256
61a97370539fb9152bcde49e8a3a3c14d91268b6b40ce1d717492f8de2b3d6b1

SHA512
2d33259532032b864a990f0da20cc9aba4b89f7f6f571426ca6f4c0900488e2d3a96bc14bd6d2868c62f2ffa8a6790e6495a7592b0bfc94c5f2111f4bfe243e1

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp
Filesize
92KB

MD5
9cc129cdfddd22a911e184c16f8b235e

SHA1
09f75e4f983c390267348d34e9152f3c4eed58a7

SHA256
16aa562b713d264a693ca15256f182a4236a7f59a3aa3e6cd7671cd18a1009ef

SHA512
5e7aadfbcf5effc2f0e0969ab10d2d4c52061f3e11e7ce1e21ebaef025e4af07d6ab66f9e33fb4954aac655a42f50fc848461f701c4b6737411c2f05cb9a9445

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp
Filesize
95KB

MD5
cfc55fdf0fefa1ff8e35f8adc133dd3c

SHA1
ff28cb4efc4c1af9328d1ea72f33ff490b9d00f2

SHA256
0fb92f129d4a0fb246981a8caf912207a9e4c6ed51d8749491fddc1ef39e9a5f

SHA512
5d44fdfcacd0aed326bb7cb929022ace4f699fe4bc1d63fbba6cdd4a43961f66ebc0c4036bf7890e7fe7b463f30dc2e52f3d07bce9d8e22297cc216d077897e7

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp
Filesize
94KB

MD5
91d3fc7db08cf65eef9c1777f14f518b

SHA1
00c0ed1d8c1d7447f4d2eb0c2d0c1ae461c5edaf

SHA256
babc60fc5572c74d27bae30c29d24a0e9b7434c5741b35ee3401da36865392ce

SHA512
f6fde0e5abe165cb49355a3be592dff49906b402853326981c1332b9d6c7f441f21e07230d7411f1b0943229e288235fc617eed8cea3d6a2165f3ba48dd67b91

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp
Filesize
86KB

MD5
519e1cadbd7f4db84188ee374e48117e

SHA1
f3668b788033c4c2cb0fd393b005563116bd95bc

SHA256
98371d3beb0ac93c0815421dbfdd0be5f8580f09d4f8722aad1450833cbbe103

SHA512
0891654a5c3a7a3c1ae0c6f434572df35d2201aae461366a7719f9c99c71624552b0ced422e929f64821f600a86abfffd1610eb7a25bbbf019d5d6e3812eecfc

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp
Filesize
87KB

MD5
9185d4a4d626173874bf100e51756a1e

SHA1
695e4ab0790e272cb761a70e1b28f56f0764a936

SHA256
a5f41cf0a7e4cd34ea776c6a12ee70246154372815a6ce16f1320c345452bbd8

SHA512
101a38a475d1b1a3201abfc4815426c71233e9bf8d66f545ab7df6f728b7ba3de5e2b746999759c23c40209dde80086a3ccb7503c7403d48405c75e5a51c711f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MS.POWERPNT.12.1033.hxn.exe
Filesize
76KB

MD5
104d7fba60ded6d4d169f52f70d1e9f5

SHA1
aea2d0fb00df792aed11b329b0692275ab089ba9

SHA256
5ee359f6cbdbcd3c579a19d652ef21f08b0231292b9a93d89a07edaf0cd272d8

SHA512
12166685282964957798a43db28fb54e4c7785f78da69217328589ff47816086caf68fae431da2ef532693f2391bbfe9a53ebb312f53f09684b60d9a3b77dfd4

Download Submit
C:\Windows\SysWOW64\Zombie.exe
Filesize
76KB

MD5
3553983fb89d6f98661029c520f45bb3

SHA1
e236a864ed37d479f897d06277460319ea3c888a

SHA256
3b39723c115c7af032101f3c19a7e5547888a2459f194da5eeaf38ff55445349

SHA512
da13f46701c47303d7f2909058810470776c5c686fe82ee382f3db588ac35e43fc01309a5313c0685b33a2cce899e1cf5307467e18b5244f4f0e262615a0002a

Download Submit